679f234d82e8703c2fc3a8efd440ac1d251cbbcd6b974ed126abab6c27ba12b5

General

Target

679f234d82e8703c2fc3a8efd440ac1d251cbbcd6b974ed126abab6c27ba12b5
Size

8KB
MD5

78e5c13c49678f46953659de59bfbe2d
SHA1

c23ade5bd1f8ed2df372517296b5a3b1355b6926
SHA256

679f234d82e8703c2fc3a8efd440ac1d251cbbcd6b974ed126abab6c27ba12b5
SHA512

7776d13a6cb019f8ef1739c7c3af1fa6a8b9f8fcce63ffa0ce524435eccedc845204d3c4dcfa7aa01b88a031da8e7324202b1b25861e34655d70f15706d81e34
SSDEEP

96:KNs/F+T1FcxTvIADxmx/0Kl9oBqH2OBAvcAGMMTVkZQShf5NICAsy3vj:KNbncBvrVmZ0TBqH2OBSrlNPAs8vj

Score

N/A

Malware Config

Signatures

Files

679f234d82e8703c2fc3a8efd440ac1d251cbbcd6b974ed126abab6c27ba12b5
.exe windows x86

938436e06852e4ad3336521232c57bfc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwReadFile
IoCreateFile
wcscpy
RtlFreeUnicodeString
wcscat
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
ExFreePoolWithTag
KeServiceDescriptorTable
NtQuerySystemInformation
RtlWriteRegistryValue
wcslen
ZwQuerySystemInformation
MmIsAddressValid
KeReleaseInStackQueuedSpinLockFromDpcLevel
MmGetSystemRoutineAddress
_stricmp
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
KeInitializeSpinLock
IoDeleteSymbolicLink
IoDeleteDevice
ExAllocatePoolWithTag
IofCompleteRequest

hal

KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 314B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1014B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

938436e06852e4ad3336521232c57bfc

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 384B - Virtual size: 314B

.data Size: 384B - Virtual size: 296B

INIT Size: 1024B - Virtual size: 1014B

.reloc Size: 256B - Virtual size: 252B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 384B - Virtual size: 314B

.data
Size: 384B - Virtual size: 296B

INIT
Size: 1024B - Virtual size: 1014B

.reloc
Size: 256B - Virtual size: 252B